Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:N/C:P/I:N/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1757472-3)
SAP Support Packages
(CAF_EU_700_SP026_000002, CAF_EU_700_SP027_000001, CAF_EU_700_SP028_000000, CAF_EU_700_SP999999_999999, CAF_EU_701_SP011_000002, CAF_EU_701_SP012_000001, CAF_EU_701_SP013_000000, CAF_EU_701_SP999999_999999, CAF_EU_702_SP011_000001, CAF_EU_702_SP012_000001, CAF_EU_702_SP013_000000, CAF_EU_702_SP999999_999999, GUIDED_PROCEDURES_CORE_710_SP014_000002, GUIDED_PROCEDURES_CORE_710_SP015_000001, GUIDED_PROCEDURES_CORE_710_SP016_000000, GUIDED_PROCEDURES_CORE_710_SP999999_999999, GUIDED_PROCEDURES_CORE_711_SP009_000001, GUIDED_PROCEDURES_CORE_711_SP010_000001, GUIDED_PROCEDURES_CORE_711_SP011_000000, GUIDED_PROCEDURES_CORE_711_SP999999_999999, GUIDED_PROCEDURES_CORE_720_SP007_000001, GUIDED_PROCEDURES_CORE_720_SP008_000001, GUIDED_PROCEDURES_CORE_720_SP009_000000, GUIDED_PROCEDURES_CORE_720_SP999999_999999, GUIDED_PROCEDURES_CORE_730_SP007_000002, GUIDED_PROCEDURES_CORE_730_SP008_000000, GUIDED_PROCEDURES_CORE_730_SP009_000000, GUIDED_PROCEDURES_CORE_730_SP999999_999999, GUIDED_PROCEDURES_CORE_731_SP003_000001, GUIDED_PROCEDURES_CORE_731_SP004_000001, GUIDED_PROCEDURES_CORE_731_SP005_000000, GUIDED_PROCEDURES_CORE_731_SP006_000000, GUIDED_PROCEDURES_CORE_731_SP999999_999999)
Описание
Information such as the Guided Procedures archiving jobs and also all usernames in the system can be discovered through the Guided Procedures Arhiving Monitoring.This information may be used by an attacker to acquire further information about Guided Procedures.
Как исправить
To correct this problem, apply the patch matching your support package version as listed in the patch table below. Follow the instructions in the SAP NetWeaver Support Package Stack Guide.As a workaround, you can disable the Guided Procedures Administration application. Follow the procedure:1. Navigate to "Content Administration" -> "Web Dynpro".2. Select object type "Application".3. Set the object name to "AdminWorkSet".4. Click on the AdminWorkSet and choose the "Disable" button.
Ссылки
